SlideShare a Scribd company logo
FAST TRACK, LAUREA TRIENNALE IN INGEGNERIA
ELETTRONICA E INFORMATICA
Articolo: High Precision Detection of
Business Email Compromise
Autori dell’articolo: Asaf Cidon, Lior Gavish, Itay Bleier, Nadia Korshun,
Marco Schweighauser e Alexey Tsitkin;
Anno accademico 2019-2020
Candidato: Davide Savron
Relatore: prof. Alberto Bartoli
tratto da: 28th USENIX Security Symposium
BUSINESS EMAIL
COMPROMISE (BEC)
• Attacco informatico basato su furto d’identità
• Obiettivo: trasferimento di denaro, informazioni
personali, ecc.
• Danni: complessivamente nei miliardi di dollari all’anno
Difficoltà rilevazione
• Le e-mail BEC sono difficili da rilevare
• Bisogna considerare il contesto in cui si trova
l’e-mail.
Progettazione
• BEC-Guard:
-Osserva le usuali comunicazioni e-mail nell’azienda
-Confronta una nuova e-mail con le usuali e-mail
• Metodo? Machine learning supervisionato
• Condizione necessaria: ‘BEC-Guard ha accesso a tutte
le email trasferite nell’organizzazione’
BEC-Guard
Organizzazione
Come ottiene le e-mail?
BEC-Guard Sistema e-mail
(Office 365)
• Condizione necessaria: ‘BEC-Guard ha accesso a
tutte le email trasferite nell’organizzazione’
• Ottenute tramite API fornite dal sistema e-mail.
Difficoltà progetto
Insieme di
email aziendali
Etichettamento
manuale
(100 000 000!!!)
(2000)E-mail BEC
E-mail legittime
Allenamento
classificatore
(99 998 000)
1. Grande numero di e-mail
da etichettare.
2. Problema sbilanciato!
50 000 email aziendali 1 un attacco BEC
Soluzione problema 1.
• Per ridurre il numero di e-mail da etichettare, si è creato
un classificatore che analizza gli header: l’impersonation
classifier
• Tale classificatore rileva tutti i possibili attacchi BEC, ma
a bassa precisione
Impersonation
classifier
Gruppo di
email
1:50 000
Tutte le
possibili BEC
1:9
Etichettamento
manuale
Per aumentare ulteriormente la
precisione, vengono aggiunti dei
classificatori di contenuto
Allenamento
altri classificatori
2000:18 000
Soluzione problema 2.
E-mail BEC
E-mail legittime
(2000)
(99 998 000)
E-mail BEC
E-mail legittime
(2000)
(2000)
Allenamento
classificatore
Prestazioni del sistema
• Si è ottenuto il primo sistema che rileva attacchi BEC in
tempo reale con alta precisione:
Data un e-mail BEC
96.9%
Classificata come
attacco
Data un e-mail
classificata come BEC
98.8%
Effettivamente un
attacco
• Basso tasso di falso allarme: 1 su 5 260 000
• Alta percentuale di attacchi rilevati:
High Precision Detection of Business e-mail Compromise

More Related Content

Featured

Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Lily Ray
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
Rajiv Jayarajah, MAppComm, ACC
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
Christy Abraham Joy
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
Vit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
MindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
RachelPearson36
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Applitools
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
GetSmarter
 
More than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike RoutesMore than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike Routes
Project for Public Spaces & National Center for Biking and Walking
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
DevGAMM Conference
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy Presentation
Erica Santiago
 
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellGood Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Saba Software
 

Featured (20)

Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 
ChatGPT webinar slides
ChatGPT webinar slidesChatGPT webinar slides
ChatGPT webinar slides
 
More than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike RoutesMore than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike Routes
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
 
Barbie - Brand Strategy Presentation
Barbie - Brand Strategy PresentationBarbie - Brand Strategy Presentation
Barbie - Brand Strategy Presentation
 
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them wellGood Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
Good Stuff Happens in 1:1 Meetings: Why you need them and how to do them well
 

High Precision Detection of Business e-mail Compromise

  • 1. FAST TRACK, LAUREA TRIENNALE IN INGEGNERIA ELETTRONICA E INFORMATICA Articolo: High Precision Detection of Business Email Compromise Autori dell’articolo: Asaf Cidon, Lior Gavish, Itay Bleier, Nadia Korshun, Marco Schweighauser e Alexey Tsitkin; Anno accademico 2019-2020 Candidato: Davide Savron Relatore: prof. Alberto Bartoli tratto da: 28th USENIX Security Symposium
  • 2. BUSINESS EMAIL COMPROMISE (BEC) • Attacco informatico basato su furto d’identità • Obiettivo: trasferimento di denaro, informazioni personali, ecc. • Danni: complessivamente nei miliardi di dollari all’anno
  • 3. Difficoltà rilevazione • Le e-mail BEC sono difficili da rilevare • Bisogna considerare il contesto in cui si trova l’e-mail.
  • 4. Progettazione • BEC-Guard: -Osserva le usuali comunicazioni e-mail nell’azienda -Confronta una nuova e-mail con le usuali e-mail • Metodo? Machine learning supervisionato • Condizione necessaria: ‘BEC-Guard ha accesso a tutte le email trasferite nell’organizzazione’ BEC-Guard Organizzazione
  • 5. Come ottiene le e-mail? BEC-Guard Sistema e-mail (Office 365) • Condizione necessaria: ‘BEC-Guard ha accesso a tutte le email trasferite nell’organizzazione’ • Ottenute tramite API fornite dal sistema e-mail.
  • 6. Difficoltà progetto Insieme di email aziendali Etichettamento manuale (100 000 000!!!) (2000)E-mail BEC E-mail legittime Allenamento classificatore (99 998 000) 1. Grande numero di e-mail da etichettare. 2. Problema sbilanciato! 50 000 email aziendali 1 un attacco BEC
  • 7. Soluzione problema 1. • Per ridurre il numero di e-mail da etichettare, si è creato un classificatore che analizza gli header: l’impersonation classifier • Tale classificatore rileva tutti i possibili attacchi BEC, ma a bassa precisione Impersonation classifier Gruppo di email 1:50 000 Tutte le possibili BEC 1:9 Etichettamento manuale Per aumentare ulteriormente la precisione, vengono aggiunti dei classificatori di contenuto Allenamento altri classificatori 2000:18 000
  • 8. Soluzione problema 2. E-mail BEC E-mail legittime (2000) (99 998 000) E-mail BEC E-mail legittime (2000) (2000) Allenamento classificatore
  • 9. Prestazioni del sistema • Si è ottenuto il primo sistema che rileva attacchi BEC in tempo reale con alta precisione: Data un e-mail BEC 96.9% Classificata come attacco Data un e-mail classificata come BEC 98.8% Effettivamente un attacco • Basso tasso di falso allarme: 1 su 5 260 000 • Alta percentuale di attacchi rilevati: